Imagine getting $1m for finding a security weakness in a mobile operating system. That’s what happened to an anonymous team of hackers who found a way to hack through Apple’s iOS to score the sizeable prize, security startup Zerodium announced this month.

Zerodium launched the challenge in September, saying it would pay seven figures to a team able to find a way to take over iPhones and iPads running the latest versions of iOS just by tricking it into visiting the wrong web page or opening a text message.

British student fights extradition to US for allegedly hacking the FBI and Nasa

Read more

Two teams actively competed for the reward, but only one was able to meet the terms of the bounty by the contest’s 31 October deadline, Zerodium founder Chaouki Bekrar said.

He said the company plans to report the vulnerabilities to its customers, described on its website as “major corporations in defence, technology, and finance” and government organisations “in need of specific tailored cybersecurity capabilities”. But it isn’t planning to immediately tell Apple how the hack works, although it may do so “later”, he said. That could help Apple create a patch to protect against the attack. Apple declined to comment.

Even if the announcement is a publicity ploy – as some security researchers believe because neither the team’s identity nor the exact details of how it broke through iOS’s defences have been revealed – there is something that we can learn from the competition. And that is the economics of hacking and the good, the bad and the questionable ways to make money by finding bugs in software.

First there are “white hat” hackers who work with companies to protect software. Many work at penetration testing companies or participate in “bug bounty” programmes. Penetration testing occurs when a company hires people to attack their products, uncovering problems that the developer can then fix. Bug bounties are sort of a dispersed version of that, where a company sets up a formal system to reward independent researchers who find flaws in their software and work with companies to fix them.

Some companies pay out fairly significant rewards. For example, Microsoft’s programmes will pay up to $15,000 for an individual bug and up to $100,000 for previously unknown techniques, which can sometimes require developers to rethink the architecture behind a system. And this market has become more organised in recent years, with companies like HackerOne popping up to help connect researchers to companies that offer such programmes.

However, not all tech companies – even ones that are good about working with researchers who come forward with problems – have bounty systems. For instance, Apple, which has a generally positive reputation among researchers, doesn’t have a formal bug bounty programme. And in some cases, companies new to the vulnerability disclosure process may feel threatened by a third-party researcher attempting to tell them about a problem and react with legal threats.

“Often security researchers are threatened with lawsuits under the Computer Fraud and Abuse Act or the Digital Millennium Copyright Act in the US, and there are similar laws around the world,” explained HackerOne’s chief policy officer Katie Moussouris. “But this doesn’t actually benefit the company in question. It may temporarily silence researchers, but the flaw is still there,” she said.

Perhaps the most obvious path to financial gain from uncovering flaws in computer code is to outright exploit problems for criminal purposes. This is where the nefarious hacker archetype comes from, but in real life, most cybercrime is a pretty professional gig – think organised gangs with formal structures. “In terms of cybercrime, the ultimate motive is usually financial,” said Raj Samani, vice-president and chief technical officer for Intel Security’s operations in Europe, the Middle East and Africa.

Often, experts say, the actual hacking part has become more of a software service system, where highly skilled hackers package up software known as exploits that carry out attacks against computer systems and networks with the bugs they find.

But the flip side of this is that as a vulnerability or exploit gets used more and more, the chances are that it will be noticed and fixed by the developers. And a lot of cybercrime doesn’t run on entirely new bugs – instead, it relies on previously known problems where users haven’t yet applied fixes to their systems. Some bad guy hackers even offer subscription-like support services to the criminals using their tools that help keep their hacking tools up and running, complete with updates that help them get around when companies patch security holes.

FBI agent J Keith Mularski, who heads the cybercrime squad, displays a screenshot from the Darkcode website, a members-only online marketplace to buy and sell hacked databases, malicious software and other “products” that can cripple or steal information from computer systems. Photograph: Gene J Puskar/AP

Criminals typically use such tools and exploits to break into databases that guard treasure troves of financial data such as credit card and banking numbers or other personal information like social security numbers and insurance information. Then they can use that data to carry out fraud and identity theft themselves, or sell it along to other criminals.

Then there’s the “zero-day market” where previously unknown vulnerabilities are privately sold, but generally to governments who look to exploit them for surveillance capabilities. These private sales can offer a heftier price tag than traditional bug bounties because the clientele includes intelligence agencies with practically unlimited budgets.

This is where Zerodium’s iOS competition comes in. The company is set up to be a middleman that pays independent hackers for new ways to break the security of major software products, and then sells that information to government agencies and major corporations at a premium.

Spy agencies value this sort of information because they can use it to get around security measures put in place by software makers to perform digital surveillance. Government hacking is becoming increasingly sophisticated as tech companies, and Apple in particular, have expanded their offerings of strong forms of encryption that prevent even the companies themselves from being able to unlock devices and the content of communications, even when served with a warrant.

And in addition to companies that outright sell zero-day vulnerabilities, there are also companies, such as Hacking Team, that sell governments such services alongside pricey subscription hacking tools that rely on such exploits.

“The longer a bug goes unfixed the more likely it is to trickle down, and affect more of the population”

Participants in this market argue they are providing a valuable tool to law enforcement and operating within the laws of individual nations – or at least in grey areas.

But these services are considered ethically questionable by privacy advocates and some security researchers at tech companies, who argue it can undermine overall security. “They are buying [an exploit] at a very high price because they are paying for silence – they are paying to keep it out of the hands of people who could fix it,” said Moussouris. “The longer a bug goes unfixed the more likely it is to trickle down, and affect more of the population down the road.”

The gulf between what companies like Zerodium say they will pay for unknown bugs and what is offered by bug bounty programmes can be wide, as evidenced by the iOS hacking bounty.

“[Tech companies] are never going to compete financially with zero-day buyers,” said American Civil Liberties Union technologist Christopher Soghoian.

Moussouris agrees that there’s “no effective way to outbid the offense market” that seeks to weaponise bugs, but argues that the industry is partially asymmetric by design: if developers like Apple started paying out that much for one hack, it would drain the talent pool of people who are building and maintaining new software, she said.

And the zero-day market represents a relatively small percentage of the security economy, according to Moussouris. Everyday users are unlikely to be targeted by the sophisticated exploits sold in the zero-day market because intelligence agencies often reserve them for attacks against the most well-protected targets. Instead, the average person is more likely to be hacked with malware that relies on issues developers have already patched, but that the individual hasn’t fixed on their machine yet.

Ultimately, for the Zerodium model to be sustainable, it would have to get more than a million dollars out of the iOS hack by selling it over and over to different clients, American Civil Liberties Union technologist Christopher Soghoian said. But it’s also possible this is a publicity stunt where the payout is a loss leader designed to get press for its initial launch, he said. Bekrar said no software other than iOS “really deserves” such a high reward to crack, but that Zerodium would offer other challenges with payouts “around six figures” in the future.

This article appeared in Guardian Weekly, which incorporates material from the Washington Post